Artificial intelligence is becoming embedded in business operations, decision making, automation, and customer-facing systems. For auditors this creates an increasingly important challenge, about providing meaningful assurance over technologies that introduce new questions around governance, data, security, transparency, and risk.
The ISACA Advanced in AI Audit™ (AAIA) certification was created specifically for experienced auditors and advisors facing that challenge. Introduced in 2025, it is an advanced credential focused on auditing AI-driven systems, while also covering how AI itself can be used within the audit process.
In this article we’ll explain exactly what AAIA covers, who it’s designed for, and how to become certified.
What Is AAIA?
AAIA is an advanced professional certification developed by ISACA, the organisation behind established credentials including CISA® Certified Information Systems Auditor and CISM®.
Unlike a general introduction to artificial intelligence, AAIA is specifically focused on assurance. It is designed to validate an auditor’s ability to assess AI-related risks, evaluate governance and controls, understand how AI systems operate, and provide advice around their responsible adoption.
AI systems bring a different set of challenges for auditors. Alongside technical performance, they may need to assess how models are governed, what data they rely on, who is accountable for their outputs, and whether appropriate controls remain effective even as systems change over time. This places greater emphasis on areas such as AI governance, risk management, data quality, transparency, and ongoing oversight.
AAIA also looks at the other side of the equation – namely, how auditors can use AI tools and techniques themselves. This can include applying AI to audit planning, data analysis, evidence collection, testing, and reporting. The result is a certification covering both the auditing of AI and the use of AI within auditing.
What Does the Certification Cover?
The AAIA examination is structured around three domains, each addressing a different part of modern AI assurance.
AI Governance and Risk accounts for 33% of the exam. This area covers AI models and requirements, governance and program management, risk management, privacy and data governance, and relevant ethical principles, regulations, standards, and frameworks.
For auditors, these topics help establish whether an organisation has the appropriate structures around its AI use. That includes questions around accountability, strategic alignment, policies, regulatory obligations, and how risks are identified and managed.
AI Operations is the largest domain, representing 46% of the exam. It covers the AI solution lifecycle, AI-specific data management, change management, supervision of AI solutions, testing techniques, threats and vulnerabilities, and incident response.
This takes the certification beyond high level governance. Auditors also need sufficient understanding of how AI systems are developed, operated, monitored, and changed to assess whether the controls surrounding them are effective.
The final 21% covers AI Auditing Tools and Techniques. This includes audit planning and design, testing and sampling methodologies, evidence collection, data quality and analytics, and audit outputs and reports.
Together, the three domains are designed to equip experienced audit professionals to evaluate AI across governance, operations, and the practical audit process itself.
Who Is AAIA For?
AAIA is deliberately positioned as an advanced certification, rather than an entry point into either AI or auditing.
It is primarily aimed at experienced IT auditors and advisors, along with professionals involved in assessing, implementing, maintaining, or auditing AI systems. Relevant roles can include IT Audit Professionals, Risk Managers, Compliance Officers, IT Risk Analysts, Information Managers, and Chief Audit Executives.
There are also formal eligibility requirements. AAIA is aimed at experienced audit professionals, with active CISA® Certified Information Systems Auditor holders automatically meeting the prerequisite. Some other recognised audit and accounting qualifications may also be accepted, depending on the candidate’s background and experience.
This means AAIA is fundamentally different from a foundation-level AI certification. Candidates are expected to bring existing audit expertise, with the certification then adding specialist capability around artificial intelligence.
For professionals who do not yet hold an eligible credential, CISA® Certified Information Systems Auditor provides one established route into the wider IT audit profession before subsequently specialising in AI assurance.
What Does the Exam Involve?
The AAIA exam consists of 90 multiple-choice questions, and lasts 150 minutes. The questions are distributed across the three domains outlined above.
Candidates must register for the exam through ISACA and hold an active qualifying credential. Once registered, they have a six-month eligibility period in which to take the examination.
Passing the exam is not quite the final step, however. Candidates must also submit their certification application, pay ISACA’s application processing fee, and continue to hold their qualifying professional designation. Once the exam has been passed, candidates have five years to formally apply for AAIA certification.
Certified professionals must then maintain the credential through continuing professional education, including AI-specific CPE requirements.
Preparing for AAIA With ALC Training
Because AAIA is aimed at experienced professionals, the preparation here is less about learning basic auditing concepts, and more about applying existing expertise to a rapidly developing technology environment.
ALC Training’s Advanced in AI Audit™ (AAIA) course is designed around that requirement. The two-day instructor-led program covers all three examination domains – AI Governance and Risk, AI Operations, and AI Auditing Tools and Techniques.
Participants receive a comprehensive course workbook, online access to the official ISACA AAIA Review Manual, and six months’ access to the official Questions, Answers and Explanations database. The AAIA exam is not included automatically in the course fee, but can be purchased as an optional addition when booking. Training is available via virtual instructor-led training.
As AI becomes more deeply integrated into organisations, auditors increasingly need to understand systems that operate very differently from traditional IT environments. AAIA provides a formal pathway for experienced professionals to develop that specialist expertise.
For CISA holders and other eligible audit professionals, it also represents a logical extension of existing assurance skills into one of the fastest-developing areas of technology risk and governance.